Felix Brandt
Writes the boring, load-bearing code that lets everyone else be interesting. Diagrams everything.
- Role
- Principal Engineer
- Based
- London
- In the journal
- 61 articles · 6 case studies
Switchyard: teaching a rail-ops board new manners
For a rail-ops platform, the board is the product. We rebuilt Switchyard's kanban with a full keyboard shuttle and warnings that mean it.
Osprey Outdoor: the pack configurator that cut support tickets
How a WebGL pack configurator with a hard 3D performance budget and a full 2D fallback cut sizing tickets and returns for an outdoor gear brand.
Quarry & Compass: real-estate search that respects the dreamers
A property platform rebuilt around how people actually browse: dream scrolling, school-catchment rituals, honest listings, and maps that fly on regional 4G.
Fernleigh Wines: a cool-climate label learns to sell online
From template storefront to editorial DTC channel: how we rebuilt Fernleigh Wines' online shop around storytelling, flexible subscriptions and cellar-door warmth.
Holloway Records: an independent label site that sells records, not ads
An independent label site built music-first: artist pages, an audio player that never interrupts, vinyl drops and a membership that pays the rent.
Signal & Noise: a podcast network site built around listening
Nine shows, one persistent player and transcripts that do real SEO work — how we built a podcast network's home on the web it actually owns.
Every AI feature needs a kill switch
Config-driven disable paths, graceful degradation, incident comms for model-caused bugs, provider outage posture, and the quarterly drill where you flip the switch.
Prompt injection: the threat model your LLM feature needs
A defensive playbook for shipped LLM features: untrusted-content labelling, tool privilege separation, output screening, canary tokens and red-team CI.
A search index built at build time
A build-time search index for static sites: tokenisation, stemming, synonyms, size budgets, sharded delivery, worker-side ranking, and proof it got better.
Form architecture at scale: schemas, errors and autofills
Schema-first form engineering: shared zod validation, error copy as data, correct autofill tokens, and announcements that don't double-speak.
Reading progress indicators: craft or clutter?
The reading progress bar is the most faked detail on the web. The honest version: when long-form needs one, how to build it without jank or lies, when to skip it.
AI answers vs good navigation: choose deliberately
Replacing your site's navigation with an AI answer box is rarely the upgrade it looks like. A decision framework for AI search vs structured browse, honestly measured.
Local-first sync engines: what we learned shipping one
Field notes from building a real sync engine: CRDT vs last-write-wins in practice, conflict UX that doesn't panic users, and when to skip it all.
Queuing writes for a flaky world
Offline writes done honestly: outbox queues, idempotency keys, optimistic state that admits it's pending, conflict surfacing, and deciding which features truly need them.
RAG and the staleness problem: freshness is a ranking signal
Stale retrieval makes RAG answers confident folklore. Treating freshness as a ranking signal, surfacing 'last updated' in answers, and designing the re-indexing pipeline.
Swapping the model without breaking the product
Model migrations without breaking the product: shadow runs, eval-gated cutovers, tone and format regression diffs, and rollback plans for behaviour you can't unit test.
Citation design: making RAG answers checkable
Citations only work if they're checkable: claim-to-chunk mapping, snippet fidelity tests, anchor UX, and what to do when the source contradicts the summary.
Optimistic UI, with integrity
Optimistic updates that keep trust: where optimism is safe vs dangerous, rollback UX when the server says no, reconciliation patterns and the latency maths behind it all.
Two tabs, one truth: state across windows
Multi-tab state consistency without the baffling UX: storage events, BroadcastChannel, optimistic locks, and how to disclose last-write-wins before it betrays someone.
The model deprecation playbook nobody writes until it's 3am
Your LLM provider just announced a deprecation window. How to migrate without panic: abstraction layers, eval-gated cutovers, shadow traffic and honest customer comms.
Rolling your own search in 2026: cheaper and better than you think
Search is a product, not a plugin. When we self-host Meilisearch or Typesense instead of renting the big names, how we tune typo tolerance, and the UX that forgives.
The TypeScript strictness ratchet: stricter every sprint, never a big bang
Strict mode on a legacy codebase is a migration disguised as a flag. The ratchet approach: incremental flags, scoped configs, codemods and type-debt metrics.
A taxonomy of micro-interactions (and when to say no)
Hover states, cursor follow, scroll reveals and button physics — a working taxonomy with duration curves, quality tests, and reduced-motion fallbacks for every pattern.
AI cost observability: tokens are a line item now
LLM features live or die on unit economics. Build per-feature token budgets, cost-per-successful-task dashboards, cache tracking and frontier charts execs actually read.
The URL is your best state manager
Filters, tabs, search and pagination belong in the URL. Shareable views, working back buttons, better analytics — plus the honest list of state to keep out of it.
Screen-reader testing: a 30-minute workflow for every release
Automated checks catch a third of accessibility problems. A repeatable 30-minute manual screen-reader script catches the rest — the workflow we run every release.
Third-party scripts: governance before they eat your site
The audit finds the mess; governance keeps it from coming back. A consent-aware loader, per-vendor budgets in CI, and the quarterly ritual that keeps tags honest.
Buying accessible software: a procurement playbook
A procurement playbook for accessibility: brief language that binds, evaluating claims beyond the VPAT, acceptance criteria that bite, and keeping standards after launch.
Activity feeds and audit logs: designing the product's memory
Activity feeds and audit logs are the product's memory: event grammar, grouping and noise control, filter architecture, and the enterprise sales case.
Analytics pipelines you can actually trust
Dashboards nobody trusts get quietly ignored. Event schemas, validation at the edge, QA environments for data, and pruning metrics nobody has read in two quarters.
Rate limits are a UX surface, not just middleware
Rate limiting starts in middleware but ends in the interface. Retry-After contracts, queue positions, backpressure UX and the copy that keeps users calm.
Address autocomplete that earns its keep
Address capture is where checkout helps or hectors: lookup with a manual escape, international format chaos, correction over scolding, and a plan for API failure.
Web Components vs React in 2026: a studio's scorecard
We build with both. An honest scorecard across portability, SSR, theming, a11y and hiring — plus where each earns its place on real projects.
CSP without the tears: a security baseline for content sites
A copy-paste security headers baseline for content sites: Content-Security-Policy with nonces, report-only rollout, and the headers nobody checks until audit.
Switching agencies mid-flight: a transition playbook
How to leave an agency — or inherit a fired one's work — without losing the project: asset inventories, handover audits, the two-sprint overlap rule.
Product search UX: from query box to answers
In-app search is a product decision wearing an engineering costume: scoping, suggestions, typo tolerance, filters vs facets, and no-results states that navigate.
Zero-downtime Postgres migrations, without heroics
Zero-downtime Postgres migrations with expand-migrate-contract: safe backfills, the locking hazards that catch everyone once, and our pre-flight checklist.
Container queries: finally designing components, not pages
Media queries ask the viewport; container queries ask the room. Production notes: containment costs, cqi type, fallbacks, and cards that go anywhere.
Design tokens are an API — version them like one
Rename a token and you ship a breaking change. Semantic versioning for token contracts, codemods for renames, migration windows, and deprecation hygiene.
Baseline 2026: what the platform finally gives you
A working guide to web Platform Baseline in 2026: what you can ship without polyfills, how to read compat data, and a sane adoption policy for teams.
Auditing third-party scripts before they audit you
Third-party scripts are a governed supply chain, not a paste bin. Our audit method: measure the cost, gate on consent, fence with CSP, and assign every tag an owner.
Background jobs: boring patterns that save your weekend
Queues vs cron, idempotency, dead-letter queues and backpressure — the boring background-job patterns that keep small teams asleep at 3am.
GraphQL vs REST, eight years in: a pragmatic retelling
GraphQL vs REST in 2026, without the zealotry: where GraphQL earned its keep, where it added cost, and the plain-REST setups we'd pick again tomorrow.
Multi-currency storefronts without the exchange-rate lies
Display currency vs settlement currency, duties honesty at checkout, geo-prompts with consent, and the switcher that quietly inflates rates — done properly.
Theme persistence without the flash
Dark mode that flashes light on load is a broken promise. Boot scripts vs cookies, SSR the right class, reconciling system preference, and testing regressions.
One schema everywhere: shared validation contracts
One Zod schema shared across client forms, API handlers and generated types. The architecture, error mapping and versioning that end validation drift for good.
Undo beats confirm: designing reversible software
Confirmation dialogs train users to click through danger. Undo-first design: timing, reversible architecture, soft deletes, and the trust dividend of forgiving software.
Plan your exit before you sign: vendor lock-in for agencies and clients
Every platform decision is also an exit decision. Portability tests, export drills, contract clauses and the abstraction seams that actually matter.
Address forms for the world: one field doesn't fit all
International checkout forms: per-country field order, autocomplete's confident lies, the phone field's real job, PO-box honesty, and testing with real parcels.
Accessibility is an engineering discipline, not a ticket queue
Treating accessibility as infrastructure: axe in CI, linting, component contracts, keyboard hierarchies, and who on the squad owns what. WCAG AA as a floor.
Testing design tokens in CI like the API they are
Design tokens are an API contract between design and engineering. The CI pipeline that enforces it: grammar linting, ancestry checks, contrast tests.
Design tokens are an API: building a pipeline from Figma to production
How we build a design-token pipeline from Figma to CSS, Tailwind and native — one source of truth, versioned releases, and semver for visual decisions.
End-to-end type safety from CMS to component
How we generate TypeScript types from headless CMS schemas, validate content at the boundary, and write content models that never cause the 6pm rename incident.
Locale switchers without the flag clipart
Language switchers are small UI with big politics. Where the control lives, name-in-own-language rules, hreflang interplay, script support, and when to skip it.
CMS migrations: the script is the deliverable
Why the migration script — not the new CMS — is the real deliverable: idempotent exports, content checksums, redirect mapping and parallel-running.
RAG pitfalls we hit so you don't have to
Retrieval in production humbles everyone. The chunking trade-offs, citation bugs, stale knowledge and eval failures that taught us how RAG actually breaks.
Digital PR for links: an honest playbook
Link earning without spam: data studies people cite, expert commentary workflows, asset-led outreach, realistic conversion rates, and how to tell if it's working.
The caching layers cake: HTTP, ISR and the discipline of invalidation
A layered caching model for content-heavy sites — CDN, full-page, data and application caches — plus the purge-on-publish pattern that ends 3am incidents.
Local-first on the web: sync engines, honestly
What local-first architecture actually costs and buys: IndexedDB patterns, CRDT trade-offs, schema migrations, sync-status UX, and when server-first is simply right.
The spreadsheet migration is the real onboarding
Most B2B onboarding is a spreadsheet migration wearing a wizard's hat. Column mapping, dry-run imports, inline validation, and the week-one trust dividend.
Permission UX: roles, extras and the politics of access
Role systems are where products quietly rot. RBAC patterns admins actually understand, invitation flows that convert, and audit trails designed as a kindness.
Cost engineering for LLM features
Unit economics for AI features: model routing, caching layers, context trimming, batch APIs, and dashboards that translate tokens into dollars per user.
Design logo systems, not logos
A logo is judged at 16 pixels and on an invoice footer, not the presentation wall. How we build tiered identity systems — marks, motion, rules — that survive.
Generating PDFs from web tech without tears
Invoices, statements and reports generated from web tech: print CSS vs headless Chrome vs canvas composition, scored honestly — plus when PDF is the wrong answer.
React Server Components: the trade-offs nobody puts in the talk
A sober field account of React Server Components: where they genuinely help, where the mental-model and caching costs bite, and how we decide per project.
Marketplace or your own store? Run the real numbers
Marketplace or your own store? The fee maths, brand equity and data trade-offs, the hybrid plays that work, and the honest case for staying put.
Launch week: the checklist we run for every site
Go-live is a week, not an afternoon. The runbook we run for every launch: redirects, DNS, analytics continuity, rollback criteria, and day-two priorities.